Privacy-Preserving and Fair Training for Federated GNN

Abstract

Graph neural networks (GNNs) have become a dominant paradigm for learning over graph-structured data. To protect data privacy in distributed graph settings, federated GNNs have emerged as a promising solution by enabling collaborative model training without raw data sharing. However, recent studies demonstrate that federated GNNs can inherit and even amplify biases from distributed data, resulting in unfair global models. While state-of-the-art (SOTA) approaches have introduced fairness-aware federated GNN frameworks, they overlook the privacy risks arising from client–server communications during training. To address this gap, we propose SaFeGNN, a Secure and Fair Federated Graph Neural Network framework that jointly enforces privacy protection and fairness guarantees. SaFeGNN secures the communication process via additive secret sharing and client-level differential privacy, achieving stronger security guarantees compared to existing solutions. Experimental results show that SaFeGNN maintains performance close to that of the baseline, with only an additional overhead of 2.7 s and 3.6 MB per global round.

1. Introduction

Graph neural networks (GNNs) have emerged as a dominant paradigm for graph-structured data processing [1]. Despite their performance, most existing GNN frameworks rely on centralized training, which becomes impractical when graph data are inherently distributed across multiple parties [2,3]. In many real-world scenarios, graph data are partitioned across organizational boundaries [4]. For example, cross-platform social networks (e.g., Facebook and Twitter) may each maintain partial and overlapping views of users and their interactions. Such distributed graph data often contain sensitive attributes, including demographic information (e.g., age) and personal identifiers (e.g., address). Direct data aggregation for centralized training therefore raises significant privacy concerns [5]. Recently, federated learning (FL) has been adopted to enable collaborative model training without requiring raw data sharing, as a promising solution [6,7].

Recent studies have demonstrated that GNN models can exhibit discriminatory behavior in their predictions [8,9]. Such biases may originate from training data distributions or structural imbalances in graph topology [9]. More critically, in federated learning (FL) settings, locally biased models can propagate unfairness to the aggregated global model, potentially amplifying discrimination at scale [2]. To mitigate this issue, the state-of-the-art framework, ${\mathrm{F}}^2\mathrm{GNN}$ [2], introduces a fairness-aware federated GNN training mechanism. However, while improving fairness, ${\mathrm{F}}^2\mathrm{GNN}$ does not address the privacy risks inherent in client–server communications in the federated training procedure.

Privacy risks in FL have been extensively studied in recent years [10]. A growing body of work demonstrates that sensitive information can be exposed during federated training, even though raw data are never directly exchanged between clients and the server [6,11,12,13,14,15]. These risks primarily arise from two sources. First, local model parameters or gradients transmitted during training may themselves encode sensitive information about the underlying data distributions [16]. Second, adversaries may exploit communicated updates to launch inference attacks, aimed at reconstructing private training samples or extracting sensitive attributes [14,15,17].

A substantial body of work has been proposed to mitigate privacy risks in FL systems [6,11,12,13,16,18], alongside research efforts on fairness-aware FL frameworks [19,20]. However, most existing privacy-preserving FL solutions are designed for conventional machine learning models and do not explicitly consider the structural dependencies inherent in graph neural networks. Consequently, these methods cannot be directly applied to the ${\mathrm{F}}^2\mathrm{GNN}$ framework without careful adaptation. Meanwhile, differential privacy has been demonstrated to provide effective protection against inference attacks in federated learning [17]. Nevertheless, its applicability to fairness-aware learning remains insufficiently explored, particularly because the injected noise may affect both model utility and fairness preservation. To bridge these gaps, we present SaFeGNN, a privacy-preserving framework for fairness-aware federated graph neural network training. Different from existing approaches that primarily protect communicated information through differential privacy, SaFeGNN focuses on securely realizing the non-linear fairness-aware aggregation procedure of F²GNN. In particular, SaFeGNN protects local model updates and fairness-related information during aggregation through secure computation and further incorporates client-level differential privacy to limit information leakage from the global models released across training rounds. Our main contributions are summarized as follows:

• We propose SaFeGNN, a secure extension of the SOTA fairness-aware federated GNN framework ${\mathrm{F}}^2\mathrm{GNN}$. SaFeGNN securely realizes the non-linear fairness-aware aggregation of ${\mathrm{F}}^2\mathrm{GNN}$, including private computation of data-bias weights, model-fairness weights, and final aggregation weights.
• We strengthen SaFeGNN with client-level differential privacy to protect the information leaked from the released global models across training rounds. Following the differentially private learning framework of [21], SaFeGNN integrates client-level differential privacy into fairness-aware federated graph neural network training.
• We implement SaFeGNN using secure computation and evaluate it on benchmark federated graph learning datasets. Experimental results show that SaFeGNN closely preserves the utility and fairness of ${\mathrm{F}}^2\mathrm{GNN}$ while providing additional privacy protection. We further evaluate the client-level DP component and demonstrate the resulting privacy–utility–fairness trade-off, including substantial utility degradation under stronger privacy guarantees.

2. Related Work

• Federated and Fair Graph Learning. Federated graph neural networks have been proposed to enable collaborative graph learning when graph data are distributed across multiple clients or organizations. Existing federated GNN studies mainly focus on improving model utility, convergence, communication efficiency, and robustness to non-IID graph distributions. For example, FedGCN [6] studies the convergence and communication trade-off in federated training of graph convolutional networks, while other studies investigate federated graph classification and representation learning under heterogeneous graph distributions [7,22,23]. These works demonstrate the feasibility of training GNNs in federated environments, but they primarily focus on utility and communication efficiency. They do not explicitly address fairness issues caused by structural bias in local graphs, nor do they protect fairness-related information exchanged during aggregation.

Fairness in graph learning has attracted increasing attention because GNNs may inherit or amplify bias from both node attributes and graph topology. Prior studies have shown that graph structure can introduce discriminatory prediction behavior, especially when sensitive groups are unevenly connected [8,24]. Existing fairness-aware graph learning methods mitigate bias by modifying graph structures, regularizing model predictions, or designing fairness-aware training objectives [8,24,25]. However, most of these approaches assume centralized access to the graph, which is unsuitable for federated graph learning where each client only owns a local graph. Fairness-aware federated learning has also been studied in standard FL settings. Representative methods, including FairFed [26], AFed [27], PrivFairFL [19], and GLOCALFAIR [20], incorporate fairness through client weighting, fairness-aware local optimization, or global–local fairness objectives. Nevertheless, these methods are generally designed for conventional vector data and do not explicitly model graph structural bias, such as imbalance between intra-group and inter-group edges.

F²GNN [2] is the closest work to ours. It introduces a structure-aware fairness mechanism for federated GNN training by considering both local data bias and local model fairness. Specifically, clients compute group balance scores from local graph topology and fairness penalty terms from local predictions, which are then used by the server to perform fairness-aware aggregation. However, F²GNN requires clients to send local model updates, group balance scores, and fairness penalty terms directly to the server.

• Privacy-Preserving Federated and Graph Learning. Privacy-preserving federated learning has been widely studied because model updates and gradients can leak sensitive information even when raw training data are not directly shared. One line of work protects client updates during aggregation using cryptographic techniques. Bonawitz et al. [16] propose a secure aggregation protocol that allows the server to obtain only the aggregate of client updates without learning each client’s individual contribution. Another line of work provides privacy guarantees through differential privacy. Geyer et al. [28] study client-level differential privacy in federated learning, where the goal is to hide the participation of any individual client. Local differential privacy has also been explored in FL; for example, LDP-Fed [29] perturbs client updates locally before they are sent to the server.

Recent systems further combine secure aggregation with differential privacy. Kairouz et al. [30] propose the distributed discrete Gaussian mechanism, where clients add discrete Gaussian noise to the discretized updates before secure aggregation, so that only the noisy aggregate is revealed. Camel [18] studies maliciously secure federated learning in the shuffle model of differential privacy, improving communication efficiency while providing both cryptographic and differential privacy guarantees. Xu et al. [13] propose a secure, efficient, and differentially private FL realization based on sparsification, combining secure aggregation with DP accounting for iterative FL training. However, these privacy-preserving FL methods are mainly designed for standard federated learning and do not explicitly consider graph-structured data or structure-aware fairness. In particular, they do not protect fairness-related intermediate values, such as group balance scores and fairness penalties, which are required by fairness-aware federated GNN aggregation.

Privacy-preserving graph learning has also been studied in centralized or service-oriented settings. Secure GNN systems such as SecGNN [31] and OblivGNN [32] use cryptographic protocols to protect graph data, model parameters, or inference results [33,34,35]. These methods show that secure computation can protect graph learning pipelines. However, they are not designed for fairness-aware federated GNN training and do not support the non-linear fairness-aware aggregation required by F²GNN.

Recent studies have also jointly investigated privacy and fairness in federated GNN settings. Agrawal et al. propose F²PGNN [36], a fairness-aware federated GNN framework for personalized recommendation. F²PGNN incorporates fairness constraints into local recommendation learning and applies local differential privacy to communicated model parameters and demographic group statistics. More recently, Dang and Nguyen propose FedFairGNN [37] for federated graph-based fraud detection. Their framework combines fairness-sensitive edge reweighting, fairness-task gradient decomposition with differential privacy, and bi-objective fairness-aware aggregation. These studies demonstrate that privacy and fairness can be considered jointly in federated GNN applications. SaFeGNN addresses a complementary privacy problem. Rather than relying solely on perturbation of information communicated to the aggregation server, SaFeGNN cryptographically protects the fairness-aware aggregation procedure itself. In particular, local model updates, graph group-balance scores, and fairness penalties are secret-shared between two non-colluding aggregation servers, which subsequently compute the data-bias weights, model-fairness weights, combined aggregation weights, and global update over secret-shared values. Client-level differential privacy is then applied to the released global models to provide protection across training rounds. Therefore, our contribution lies in securely realizing structure-aware fairness aggregation while combining cryptographic protection of intermediate values with differential privacy for released models.

Different from the above studies, SaFeGNN jointly considers three requirements: federated graph learning, structure-aware fairness, and privacy-preserving aggregation with differential privacy. Compared with federated GNN methods [6,7,22,23], SaFeGNN explicitly accounts for fairness caused by graph structural bias. Compared with fairness-aware graph learning and fairness-aware FL methods [8,19,20,24,26,27], SaFeGNN targets federated graph data and protects fairness-related statistics. Compared with F²GNN [2], SaFeGNN protects local updates, group balance scores, fairness penalties, and aggregation weights through secure computation. Compared with privacy-preserving FL and graph learning methods [13,16,18,28,30,31,32,36,37], SaFeGNN securely realizes the non-linear fairness-aware aggregation required by F²GNN and further incorporates client-level differential privacy to protect the released global models across training rounds (Table 1).

Table 1. Comparisons of related work and ours.

Methods	FL	GNN	GS	Fairness	SAgg	DP
F2GNN [2]	✓	✓	✓	✓
FedGCN [6]	✓	✓
GCFL [7]	✓	✓
EDITS [8]		✓	✓	✓
Bonawitz et al. [16]	✓				✓
Camel [18]	✓				✓	✓
PrivFairFL [19]	✓			✓		✓
GLOCALFAIR [20]	✓			✓
FedSage+ [22]	✓	✓
FairGNN [24]		✓		✓
FairFed [26]	✓			✓
AFed [27]	✓			✓
Kairouz et al. [30]	✓				✓	✓
SecGNN [31]		✓			✓
F2PGNN [36]	✓	✓		✓		✓
FedFairGNN [37]	✓	✓		✓		✓
SaFeGNN (ours)	✓	✓	✓	✓	✓	✓

FL denotes federated learning; GS denotes graph structure awareness; SAgg denotes secure aggregation; DP denotes differential privacy. ✓ indicates that the method supports the corresponding feature

3. Preliminaries

3.1. Fairness-Aware FL-GNN Training ($F^2\mathit{GNN}$)

• We follow the SOTA plaintext fairness-aware federated GNN framework, namely ${\mathrm{F}}^2\mathrm{GNN}$ [2] in this work. We summarize the framework as follows:

Let $\mathcal{C}=\{{\mathcal{C}}_1,\dots ,{\mathcal{C}}_n\}$ denote a set of clients and let $\mathcal{S}$ denote the aggregation server. Each client ${\mathcal{C}}_i$ holds a private local graph $G_i=(V_i,E_i,X_i)$, where $V_i$ is the node set, $E_i$ is the edge set, and $X_i$ is the node feature matrix. Each node is associated with a sensitive attribute $s\in \{0,1\}$ and a task label y. The goal of ${\mathrm{F}}^2\mathrm{GNN}$ is to collaboratively train a global GNN model $\mathbf{w}$ while improving group fairness without directly sharing local graphs.

Group balance score. For each local graph $G_i$, edges are partitioned into intra-group edges and inter-group edges according to the sensitive attributes of their endpoints. Let $E_i^{\mathrm{intra}}$ be the set of edges connecting nodes from the same sensitive group, and let $E_i^{\mathrm{inter}}$ be the set of edges connecting nodes from different sensitive groups. The local group balance score is defined as $B_i=1-\left|H_i^{\mathrm{intra}}-H_i^{\mathrm{inter}}\right|$, where $H_i^{\mathrm{intra}}={\displaystyle \frac{|E_i^{\mathrm{intra}}|}{|E_i|}},H_i^{\mathrm{inter}}={\displaystyle \frac{|E_i^{\mathrm{inter}}|}{|E_i|}}$. A larger $B_i$ indicates a more balanced distribution between intra-group and inter-group edges.

Client-side fairness-aware local update. At global training round t, the server sends the current global model ${\mathbf{w}}^t$ to a selected subset of clients. Each client $C_i$ first compares the prediction distributions of its previous local model ${\mathbf{w}}_i^{t-1}$ and the received global model ${\mathbf{w}}^t$ on its local graph. Let ${\widehat{Y}}_{\mathrm{local}}$ and ${\widehat{Y}}_{\mathrm{global}}$ denote the corresponding prediction distributions. The client computes the Jensen–Shannon divergence ${\mathrm{js}}_i^t=\mathrm{JS}\left(D_{{\widehat{Y}}_{\mathrm{global}}}\parallel D_{{\widehat{Y}}_{\mathrm{local}}}\right)$. It then initializes its local model by interpolating between the previous local model and the current global model: ${\widehat{\mathbf{w}}}_i^t\leftarrow (1-{\mathrm{js}}_i^t)·{\mathbf{w}}_i^{t-1}+{\mathrm{js}}_i^t·{\mathbf{w}}^t$. The client then trains the local GNN model using a fairness-aware method as follows:

Let ${\Delta }_{{\mathrm{SP}}_i}$ and ${\Delta }_{{\mathrm{EO}}_i}$ denote the local statistical parity gap and equalized odds gap, respectively. The local fairness penalty is ${\ell }_{{\mathrm{fair}}_i}={∥{\Delta }_{{\mathrm{SP}}_i}∥}_1+{∥{\Delta }_{{\mathrm{EO}}_i}∥}_1$. The local training loss function is ${\ell }_i({\mathbf{w}}_i^t;{\mathcal{D}}_i)={\ell }_{{\mathrm{util}}_u}+\alpha ·{\ell }_{{\mathrm{fair}}_i}$, where $\alpha$ controls the rate of the fairness penalty. The client performs local gradient descent: ${\mathbf{w}}_i^t\leftarrow {\widehat{\mathbf{w}}}_i^t-\eta ·\nabla {\ell }_i\left({\mathbf{w}}_i^t\right)$, where $\eta$ is the learning rate. After local training, client $C_i$ sends its updated local model ${\mathbf{w}}_i^t$, fairness penalty ${\ell }_{{\mathrm{fair}}_i}$, and group balance score $B_i$ to the server.

Server-side fairness-weighted aggregation. After receiving updates from K selected clients, the server computes two types of aggregation weights. First, the server computes the data-bias weight based on the clients’ group balance scores: ${\gamma }_{\epsilon }^t=\mathrm{softmax}\left(B^1,\dots ,B^K\right)$. Second, the server computes the model-fairness weight from the clients’ local fairness penalty terms: ${\gamma }_{\mathcal{F}}^{\prime t}=\left[{\ell }_{{\mathrm{fair}}_1},\dots ,{\ell }_{{\mathrm{fair}}_K}\right]$, and rescales it as ${\gamma }_F^t=\exp \left(\mathrm{softmax}\left({{\gamma }^{\prime }}_F^t\right)\right)$. The final combined aggregation weight is then computed as ${\gamma }^t=\mathrm{softmax}\left({\displaystyle \frac{\lambda ·{\gamma }_{\epsilon }^t+{\gamma }_{\mathcal{F}}^t}{\tau }}\right)$, where $\lambda$ controls the influence of the data-bias weight and $\tau$ is the softmax temperature. Finally, the server updates the global model by weighted aggregation: ${\mathbf{w}}_{t+1}={\sum }_{i=1}^K{\gamma }_i^t·{\mathbf{w}}_i^t$, where ${\gamma }_i^t$ is the i-th element of ${\gamma }^t$. The updated global model ${\mathbf{w}}^{t+1}$ is then broadcast to clients for the next global training round.

Output. After T rounds, ${\mathrm{F}}^2\mathrm{GNN}$ outputs a global GNN model $\mathbf{w}$ that is trained over distributed graph data while accounting for both local data bias and local model fairness during local optimization and global aggregation.

3.2. Additive Secret Sharing

Additive secret sharing [38] allows a secret value to be distributed among multiple parties such that no individual party can recover the secret alone. Let ${\mathbb{Z}}_q$ denote a finite ring modulo q, and let $x\in {\mathbb{Z}}_q$ be a private value. In a two-party additive secret sharing scheme, the secret x is split into two shares: $⟨x⟩=(x_1,x_2)$, where each party $P_i$ holds one share $x_i\in {\mathbb{Z}}_q$, and the secret can be reconstructed as $x=x_1+x_2\left(\mathrm{mod}q\right)$.

To share a secret x, the dealer samples two shares uniformly at random: $x_1,x_2\stackrel{\$}{\leftarrow }{\mathbb{Z}}_q$, and computes the final share as $x_i=x-x_{1-i}\left(\mathrm{mod}q\right)$. Since any single share is uniformly random over ${\mathbb{Z}}_q$, the secret remains information-theoretically hidden from any individual party. We summarize the basic building blocks as follows:

Local Computations. Given two shared secrets $⟨x⟩=(x_1,x_2)$ and $⟨y⟩=(y_1,y_2)$, parties can locally compute a sharing of $z=x+y$ by adding their shares: $z_i=x_i+y_i\left(\mathrm{mod}q\right)$. Thus, $⟨z⟩=⟨x⟩+⟨y⟩$. Similarly, parties can locally compute a sharing of $z=x-y$ as: $z_i=x_i-y_i\left(\mathrm{mod}q\right)$. Thus, $⟨z⟩=⟨x⟩-⟨y⟩$. For a public scalar $c\in {\mathbb{Z}}_q$, parties can locally compute a sharing of $z=cx$ by multiplying each share by c: $z_i=c·x_i\left(\mathrm{mod}q\right)$. Hence, $⟨z⟩=c·⟨x⟩$.

Secure Multiplications. Unlike addition and scalar multiplication, multiplying two secret-shared values cannot be done by simply multiplying local shares. Given $⟨x⟩$ and $⟨y⟩$, parties require an interactive protocol to compute: $⟨z⟩=⟨x·y⟩$. This is commonly achieved using multiplication triples, also known as Beaver triples [39]. A Beaver triple consists of random shared values: $⟨a⟩,⟨b⟩,⟨c⟩$, where $c=a·b\left(\mathrm{mod}q\right)$. To multiply $⟨x⟩$ and $⟨y⟩$, parties compute: $⟨d⟩=⟨x⟩-⟨a⟩$, $⟨e⟩=⟨y⟩-⟨b⟩$, then open d and e. The product is computed as: $⟨z⟩=⟨c⟩+d·⟨b⟩+e·⟨a⟩+de$. For higher-level operations beyond the above computations, we adopt the techniques in [40].

3.3. Differential Privacy

Differential Privacy (DP) is a rigorous privacy framework that provides quantifiable guarantees against information leakage from the output of a computation. Informally, DP ensures that the inclusion or exclusion of any single individual’s data has a limited impact on the output distribution of a mechanism.

Definition 1

(Approximate Differential Privacy-($ϵ,\delta$)-DP [41]). Let $\mathcal{D}$ and ${\mathcal{D}}^{\prime }$ be two neighboring inputs. A randomized mechanism $\mathcal{M}:\mathcal{D}\to \mathcal{Y}$ satisfies $(ϵ,\delta )$-differential privacy if for all measurable subsets $\mathcal{S}\subseteq \mathcal{Y}$:

$$\mathrm{Pr}[\mathcal{M}\left(\mathcal{D}\right)\in \mathcal{S}]\le e^{ϵ}·\mathrm{Pr}[\mathcal{M}\left({\mathcal{D}}^{\prime }\right)\in \mathcal{S}]+\delta ,$$

where $ϵ>0$ is the privacy budget and $\delta \ge 0$ is a small failure probability. When $\delta =0$, the guarantee is referred to as pure differential privacy ϵ-DP.

In this paper, we adopt client-level differential privacy under add/remove adjacency. Specifically, let $\mathcal{D}=\{D_1,\dots ,D_n\}$ denote the collection of local datasets held by the clients. Two federated inputs $\mathcal{D}$ and ${\mathcal{D}}^{\prime }$ are neighboring, if they differ by the addition or removal of the entire local dataset of one client.

Definition 2

(Rényi Differential Privacy-($\alpha ,ϵ$)-RDP [42]). For two probability distributions P and Q, the Rényi divergence of order $\alpha >1$ is defined as

$$D_{\alpha }(P\parallel Q)\triangleq {\displaystyle \frac{1}{\alpha -1}}\log \left({\mathbb{E}}_{x\sim Q}\left[{\left({\displaystyle \frac{P\left(x\right)}{Q\left(x\right)}}\right)}^{\alpha }\right]\right).$$

A randomized mechanism $\mathcal{M}$ satisfies $(\alpha ,ϵ)$-RDP if, for any two neighboring datasets D and $D^{\prime }$, we have $D_{\alpha }\left(\mathcal{M}\left(D\right)\parallel \mathcal{M}\left(D^{\prime }\right)\right)\le ϵ$. Compared with standard $(ϵ,\delta )$-differential privacy, RDP provides a way to track tighter cumulative privacy loss under composition.

Lemma 1

(Adaptive Composition of RDP [42]). If a sequence of mechanisms ${\mathcal{M}}_1,\dots ,{\mathcal{M}}_T$ satisfies $(\alpha ,{ϵ}_1)$-RDP, …, $(\alpha ,{ϵ}_T)$-RDP, respectively, then their adaptive composition satisfies $\left(\alpha ,{\sum }_{t=1}^T{ϵ}_t\right)\text{-}\mathit{RDP}$.

Moreover, an $(\alpha ,ϵ)$-RDP mechanism also satisfies $({ϵ}^{\prime },\delta )$-differential privacy for any $0<\delta <1$, where ${ϵ}^{\prime }=ϵ+{\displaystyle \frac{\log (1/\delta )}{\alpha -1}}$.

Lemma 2

(Gaussian Mechanism [42]). The Gaussian mechanism achieves $(ϵ,\delta )$-differential privacy by adding noise drawn from a Gaussian distribution:

$$\mathcal{M}\left(\mathcal{D}\right)=f\left(\mathcal{D}\right)+\mathcal{Z},\mathcal{Z}\sim \mathcal{N}(0,{\sigma }^2{\Delta }^{2}f·I),$$

where σ is the noise multiplier, the ${\ell }_2$ sensitivity defined as $\Delta f={\mathit{max}}_{\mathcal{D},{\mathcal{D}}^{\prime }}$${∥f\left(D\right)-f\left(D^{\prime }\right)∥}_2$, and I is the identity matrix.

4. System Design

4.1. System Model

We consider a federated graph learning system built upon ${\mathrm{F}}^2\mathrm{GNN}$ [2], where multiple clients collaboratively train a fair graph neural network without directly sharing their local graph data. Each client owns a local graph, including node features, structure, and labels. The goal is to learn a global model that achieves high predictive utility while mitigating bias with respect to sensitive attributes.

The system consists of two main entities: clients and two aggregation servers. Each client locally trains a GNN model using its private graph data and computes model updates. Following ${\mathrm{F}}^2\mathrm{GNN}$ [2], clients may also derive fairness-aware weighting information, such as group balance score (GBS), denoted as B, and fairness penalty term ${\ell }_{\mathrm{fair}}$, to guide the global aggregation process. However, unlike the original ${\mathrm{F}}^2\mathrm{GNN}$ framework, our system does not require clients to reveal these intermediate terms or model updates to the server.

To protect client privacy during aggregation, we introduce a secure computation layer, namely Sec${\mathrm{F}}^2\mathrm{GNN}$, based on additive secret sharing. Before transmission, each client secret-shares its local model update and fairness-related information to two aggregation servers. These servers jointly execute the aggregation protocol over secret-shared values and only reveal the final aggregated update to the clients. As a result, no single server can observe an individual client’s raw update, GBS, and fairness penalty term.

In addition to Sec${\mathrm{F}}^2\mathrm{GNN}$ aggregation, the system incorporates client-level differential privacy to provide formal protection against information leakage from the released global model. Specifically, client updates are clipped to bound their sensitivity, and calibrated Gaussian noise is added by the servers. This ensures that the contribution of any individual client is statistically hidden, even from an adversary observing the sequence of released global models across multiple training rounds.

In summary, the global training proceeds iteratively. In each communication round, the server broadcasts the current global model to selected clients. Each selected client performs local training on its private graph data, computes its local update and fairness-related aggregation information, and secret-shares these values to the servers. The servers securely compute a combined weight and differentially private aggregate update, which is then returned to the clients to start next training round until the global model converges. The system workflow is illustrated in Figure 1.

Figure 1. SaFeGNN system workflow.

4.2. Threat Model

SaFeGNN is designed to protect client privacy against threats from servers and other clients. On the server side, we adopt the standard assumption of non-colluding, semi-honest adversaries, which is widely used in two-server settings [18,31]. Under this assumption, SaFeGNN guarantees that the servers learn no information about clients’ local parameters or intermediate results, including group balance scores, fairness penalty, model parameters, as well as the data-bias weight, model-fairness weight, and their combined weight.

On the client side, we consider honest-but-curious clients. Each client follows the protocol, including local training, computation of the fairness-related statistics and update norm, and secret sharing of these values to the two aggregation servers, but may attempt to infer information from its local view and the released global models. Clients may collude with other clients, but we assume that no client colludes with either aggregation server.

We distinguish the privacy guarantees provided by secure computation and differential privacy. The secure computation protocol protects individual client updates and fairness-related statistics against the semi-honest aggregation servers. In contrast, the client-level differential privacy guarantee concerns information leakage through the sequence of released global models. The aggregation servers know the identities of the clients selected in each round; therefore, the DP guarantee does not aim to hide the sampled-client set from the aggregation servers.

5. Protocol Details

In this section, we introduce the detailed protocols of Sec${\mathrm{F}}^2\mathrm{GNN}$ aggregation and describe how Gaussian noise is added by the two servers, composed of SaFeGNN algorithm as demonstrated in Algorithm 1.

Algorithm 1 SaFeGNN training.
Input: Each client ${\mathcal{C}}_i$ holds a local dataset ${\mathcal{D}}_i$ for $i\in \{1,\dots ,n\}$; Servers ${\mathcal{S}}_b(b\in \{0,1\})$ holds clip bound C and noise multiplier $\sigma$.
Output: Clients ${\mathcal{C}}_i$ obtain a global model $\mathbf{w}$.
1: procedure Global training(${\left\{{\mathcal{D}}_i\right\}}_{i\in \{0,\dots ,n\}}$)
2:     Servers initialize ${⟨{\mathbf{w}}^0⟩}_b$.
3:     Clients train local model ${\mathbf{w}}_i^0$.
4:     for $t\in \{1,\dots ,T\}$ do	▹ Total T rounds in global training.
5:          ${\mathcal{S}}_b$→${\mathcal{C}}_i$: ${⟨{\mathbf{w}}^t⟩}_b$.
// Clients locally generate shared updates and fairness parameters:
6:         ${\mathsf{\Delta }}_i^t,B_i,{\ell }_{fai{r}_i}^t\leftarrow \mathrm{LocalUpdate}({\mathcal{D}}_i,$${⟨{\mathbf{w}}^t⟩}_0$,${⟨{\mathbf{w}}^t⟩}_1$).
7:         ${⟨{\mathsf{\Delta }}_i^t⟩}_b$$\leftarrow \mathrm{Shr}\left({\mathsf{\Delta }}_i^t\right)$; ${⟨B_i⟩}_b$$\leftarrow \mathrm{Shr}\left(B_i\right)$;
${⟨{\ell }_{fai{r}_i}^t⟩}_b$$\leftarrow \mathrm{Shr}\left({\ell }_{fai{r}_i}^t\right)$; ⟨${∥{\mathsf{\Delta }}_i^t∥}_2$${⟩}_b$$\leftarrow \mathrm{Shr}$ (${∥{\mathsf{\Delta }}_i^t∥}_2$).
8:         ${\mathcal{C}}_i$→${\mathcal{S}}_b$: ${⟨{\mathsf{\Delta }}_i^t⟩}_b$, ${⟨B_i⟩}_b$, ${⟨{\ell }_{fai{r}_i}^t⟩}_b$, ⟨${∥{\mathsf{\Delta }}_i^t∥}_2$${⟩}_b$.
// Servers securely aggregate global model following $F^2\mathit{GNN}$ method:
9:          ${\mathcal{S}}_0$ and ${\mathcal{S}}_1$ randomly sample q clients from n clients with shared seed.
10:          ${\mathcal{S}}_0$ and ${\mathcal{S}}_1$ engage in secure computation protocols in [40] via communications:
11:          ${⟨{\gamma }_{\epsilon }^t⟩}_b$←${\Pi }_{\mathrm{Softmax}}($${⟨B_1⟩}_b$, …, ${⟨B_q⟩}_b$).
12:          ${⟨{\gamma }_{\mathcal{F}}^t⟩}_b$$\leftarrow {\Pi }_{\mathrm{Softmax}}($${⟨{\ell }_{fai{r}_1}^t⟩}_b$, …, ${⟨{\ell }_{fai{r}_q}^t⟩}_b$).
13:          ${⟨{\gamma }_{\mathcal{F}}^t⟩}_b$$\leftarrow {\Pi }_{\mathrm{Exp}}($${⟨{\gamma }_{\mathcal{F}}^t⟩}_b$).
14:          ${\mathcal{S}}_b:$${⟨{\gamma }^t⟩}_b\leftarrow {\displaystyle \frac{\lambda ·{⟨{\gamma }_{\epsilon }^t⟩}_b+{⟨{\gamma }_{\mathcal{F}}^t⟩}_b}{\tau }}$.	▹${\mathcal{S}}_b$ locally computes it for constant $\lambda ,\tau$ in Section 3.1.
15:          ${⟨{\gamma }^t⟩}_b\leftarrow {\Pi }_{\mathrm{Softmax}}\left({⟨{\gamma }^t⟩}_b\right)$.
16:          ${⟨{\tilde{\mathbf{w}}}^{t+1}⟩}_b$← DP-Sec${\mathrm{F}}^2\mathrm{GNN}$(${⟨{\mathsf{\Delta }}^t⟩}_b$, C, $\sigma ,$⟨${∥{\mathsf{\Delta }}^t∥}_2$${⟩}_b$, ${⟨{\mathbf{w}}^t⟩}_b$, ${⟨{\gamma }^t⟩}_b$)
17:     end for
18:     ${\mathcal{S}}_b$→${\mathcal{C}}_i$: ${⟨{\tilde{\mathbf{w}}}^{T+1}⟩}_b$.
19:     return ${\mathcal{C}}_i:{\tilde{\mathbf{w}}}^{T+1}\leftarrow$${⟨{\tilde{\mathbf{w}}}^{T+1}⟩}_0$+${⟨{\tilde{\mathbf{w}}}^{T+1}⟩}_1$.	▹ All clients can reconstruct global model.
20: end procedure
21: procedure DP-Sec${\mathrm{F}}^2\mathrm{GNN}$(${⟨{\mathsf{\Delta }}^t⟩}_b$, C, $\sigma ,$⟨${∥{\mathsf{\Delta }}^t∥}_2$${⟩}_b$, ${⟨{\mathbf{w}}^t⟩}_b$, ${⟨{\gamma }^t⟩}_b$)
22:     ${\mathcal{S}}_0$ and ${\mathcal{S}}_1$ engage in secure computation protocols in [40] via communications:
${⟨{\tilde{\mathsf{\Delta }}}_i^t⟩}_b$$\leftarrow {\Pi }_{\mathrm{Sec}\mathrm{Min}}(1,{\displaystyle \frac{C}{⟨{∥{\mathsf{\Delta }}_i^t∥}_2{⟩}_b}})·$${⟨{\mathsf{\Delta }}_i^t⟩}_b$.	▹ Clipping updates.
23:     ${\mathcal{S}}_b$ locally aggregates clipped updates: ${⟨{\mathbf{w}}^{t+1}⟩}_b$←${⟨{\mathbf{w}}^t⟩}_b$$-{\sum }_{i=1}^q$${⟨{\gamma }_i^t⟩}_b$·${⟨{\tilde{\mathsf{\Delta }}}_i^t⟩}_b$.
24:     Server ${\mathcal{S}}_b$ locally sample noise: $Z_b^t\sim \mathcal{N}\left(0,2{\sigma }^2{C}^{2}I\right)$.
25:     Server ${\mathcal{S}}_b$ locally adds noise:
${⟨{\tilde{\mathbf{w}}}^{t+1}⟩}_b$←${⟨{\mathbf{w}}^{t+1}⟩}_b$$+Z_b^t$.
26:     return ${⟨{\tilde{\mathbf{w}}}^{t+1}⟩}_b$.
27: end procedure
28: procedure LocalUpdate($({\mathcal{D}}_i,$${⟨{\mathbf{w}}^t⟩}_0$,${⟨{\mathbf{w}}^t⟩}_1$))
29:     ${\mathbf{w}}_i^t\leftarrow$${⟨{\mathbf{w}}^t⟩}_0$+${⟨{\mathbf{w}}^t⟩}_1$.
30:     ${\widehat{\mathbf{w}}}_i^t\leftarrow (1-{\mathrm{js}}_i^t)·{\widehat{\mathbf{w}}}_i^{t-1}+{\mathrm{js}}_i^t·{\mathbf{w}}^t$.	▹ Follow the method in Section 3.1 for JS convergence.
31:     $B_i\leftarrow 1-\left|H_i^{\mathrm{intra}}-H_i^{\mathrm{inter}}\right|$.	▹ Follow the method in Section 3.1.
32:     for local epoch $e\in \{t,\dots ,t+E\}$ do	▹E epochs in local training.
33:            $L_i\leftarrow {\ell }_{{\mathrm{util}}_i}^t+\alpha ·{\ell }_{{\mathrm{fair}}_i}^t$.	▹ Follow the method in Section 3.1.
34:            ${\widehat{\mathbf{w}}}_i^{e+1}\leftarrow {\widehat{\mathbf{w}}}^e-{\eta }_l·\nabla L_i({\widehat{\mathbf{w}}}^e,{\mathcal{D}}_i)$.	▹ Learning rate ${\eta }_l$ and loss function $L_i$
35:     end for
36:     ${\widehat{\mathbf{w}}}_i^t\leftarrow {\widehat{\mathbf{w}}}_i^{t+E+1}$
37:     ${\mathsf{\Delta }}_i^t\leftarrow {\mathbf{w}}_i^t-{\widehat{\mathbf{w}}}_i^t$.
38:     return ${\mathsf{\Delta }}_i^t,B_i,{\ell }_{{\mathrm{fair}}_i}^t$, ${∥{\mathsf{\Delta }}_i^t∥}_2$.
39: end procedure

5.1. Sec$F^2\mathit{GNN}$ Aggregation

Overview. The secure ${\mathrm{F}}^2\mathrm{GNN}$ aggregation protocol ${\Pi }_{\mathrm{Sec}{\mathrm{F}}^2\mathrm{GNN}}$ extends the ${\mathrm{F}}^2\mathrm{GNN}$ aggregation method to a secure computation via two-party secret sharing setting. It takes as input group balance score, local model updates and fairness penalty. The secure computation produces secret-share of intermediate results including shared data-bias weights, shared model-fairness weights, and shared combined weights. The combined weights are subsequently used to aggregate the global model from local model updates.

Construction. The detailed construction of our protocol is shown in Algorithm 1. We introduce two non-colluding computational servers that jointly execute the secure aggregation procedure. At a high level, each client first performs local training and computes the required fairness-related parameters by invoking LocalUpdate. The resulting local model update and auxiliary fairness parameters are then split into secret shares and distributed to the two servers. Given these shares, the servers jointly execute a secure computation protocol that realizes the aggregation procedure of ${\mathrm{F}}^2\mathrm{GNN}$ without revealing any individual client update or fairness-related parameter.

More concretely, the servers compute two secure softmax functions to obtain secret shares of the data-bias weight ${\gamma }_{\epsilon }^t$ and the model-fairness weight ${\gamma }_{\mathcal{F}}^t$. The model-fairness weight is further rescaled via a secure exponential function, following the same process of ${\mathrm{F}}^2\mathrm{GNN}$. The two resulting weights are then combined locally in each server according to the ${\mathrm{F}}^2\mathrm{GNN}$ weighting rule, parameterized by hyperparameters $\lambda$ and $\tau$. After applying a secure softmax function to the combined scores, the servers obtain the final aggregation weights in secret-shared form. Finally, the servers securely compute the aggregated global model update by multiplying each client update with its corresponding combined weight in the secret-shared domain. Since LocalUpdate is executed entirely on the client side, it remains identical to the plaintext ${\mathrm{F}}^2\mathrm{GNN}$ implementation in Section 3.1.

Note that, up to this point, no single server learns the global model. Before revealing the final model to the clients, each server independently adds Gaussian noise to its share, thereby ensuring differential privacy.

5.2. DP-Sec$F^2\mathit{GNN}$ Noise Addition

Overview. To securely and efficiently add differential privacy noise, each aggregation server independently samples Gaussian noise and locally adds it to its share of the aggregated model. The noise variance assigned to each server is calibrated such that, after the two output shares are reconstructed, the resulting perturbation follows the Gaussian distribution required by the differential privacy mechanism. Since the sum of independent Gaussian random variables is Gaussian, this procedure allows the servers to generate the required perturbation without any single server learning the plaintext aggregated model.

Construction. The detailed construction of DP-Sec${\mathrm{F}}^2\mathrm{GNN}$ is presented in Algorithm 1. In each round, each selected client update is clipped before aggregation, where the contribution of each selected client is bounded by the clipping threshold C. Under client-level add/remove adjacency, we use $2C$ as the per-round sensitivity bound of the subsampled Gaussian mechanism. The client sampling rate is $q/n$, which is used only in the RDP accountant for privacy amplification by subsampling.

To provide differential privacy, each server ${\mathcal{S}}_b$ independently samples Gaussian noise $Z_b^t\sim \mathcal{N}\left(0,2{\sigma }^2{C}^{2}I\right)$ and adds it to its share of the aggregated update, where C is the clipping bound and $\sigma$ is the noise multiplier. The servers then send the perturbed output shares ${⟨{\tilde{\mathbf{w}}}^{t+1}⟩}_b$ to the clients. Each client reconstructs the noisy global model as ${\tilde{\mathbf{w}}}^{t+1}={⟨{\tilde{\mathbf{w}}}^{t+1}⟩}_0+{⟨{\tilde{\mathbf{w}}}^{t+1}⟩}_1$. Since $Z_0^t$ and $Z_1^t$ are sampled independently, the total noise in the reconstructed model is $Z^t=Z_0^t+Z_1^t\sim \mathcal{N}\left(0,4{\sigma }^2{C}^{2}I\right)$. The reconstructed model is then used as the global model for the next training round. By clipping each local update and adding Gaussian noise calibrated to the clipping bound, DP-Sec${\mathrm{F}}^2\mathrm{GNN}$ ensures that the released global model satisfies $(ϵ,\delta )$-differential privacy as shown in Section 7.1.

6. Experiments

6.1. Experimental Settings

Environments. We implemented our protocols using the MP-SPDZ (v0.4.3) framework [43] to execute secure computation among servers. MP-SPDZ supports various MPC protocols, including ASS for semi-honest settings. For efficiency evaluation, our protocols were deployed on a local machine with an Intel(R) Core(TM) i7-14700KF processor, 28 CPU cores, and 46 GB of RAM. The two-party computation environment was simulated and executed using virtual machines hosted on the same machine.

Datasets. We evaluate SaFeGNN on the Pokec-z and Pokec-n social graphs. The raw Pokec-z data contain 67,796 nodes and 882,765 relationship records, while Pokec-n contains 66,569 nodes and 729,129 relationship records. In both datasets, the prediction target is “I am working in field" and the sensitive attribute is region.

Federated client graph construction. Following ${\mathrm{F}}^2\mathrm{GNN}$ [2], we construct the federated clients using egocentric subgraphs. Specifically, we randomly select 30 nodes from the training-node set as ego centers and extract the three-hop neighborhood of each center from the original graph. Each resulting three-hop ego network is treated as the local graph of one client. Since the ego networks are constructed independently, different client graphs may overlap and may therefore contain common nodes or edges.

Hyperparameters. Unless otherwise specified, all experiments follow the same training configuration as the plaintext ${\mathrm{F}}^2\mathrm{GNN}$ baseline, using a two-layer GCN model. The first graph-convolution layer maps the input features to 64 hidden units and is followed by ReLU activation and dropout; the second graph-convolution layer retains 64 hidden units and is followed by a linear 64-to-1 binary classifier. Models are optimized using Adam with a learning rate of ${10}^{-4}$ for 500 global rounds. In each round, $10\%$ of the clients are sampled, and each client is represented by a three-hop ego network. For Pokec-z, we use 20 local epochs, dropout $0.5$, weight decay ${10}^{-3}$, ${\lambda }_1=0.5$, and ${\tau }_{\mathrm{combine}}=0.01$. For Pokec-n, we use 15 local epochs, dropout $0.1$, weight decay ${10}^{-4}$, ${\lambda }_1=8.0$, and ${\tau }_{\mathrm{combine}}=0.001$. For both datasets, the fairness regularization coefficient is $\alpha ={10}^{-6}$, the aggregation and fairness temperatures are $\tau ={\tau }_f=4$. We evaluate configurations with $n=30$ clients, corresponding to $q=3$ selected client slots per round. Results are averaged over five random seeds: $\{31,32,33,34,35\}$ for Pokec-z and $\{47,48,49,50,51\}$ for Pokec-n.

Evaluation metrics. We follow [2] and adopt the same evaluation metrics. Specifically, we evaluate the predictive utility of the GNN model using Accuracy and AUC. To assess fairness, we report Statistical Parity and Equal Opportunity over the model predictions, where lower values correspond to stronger fairness guarantees.

6.2. Performance Evaluation on Secure Computation

The secure computation is conducted using the same random seeds as ${\mathrm{F}}^2\mathrm{GNN}$ [2], namely seed 47 for Pokec-n and seed 31 for Pokec-z.

Evaluations. We first evaluate whether the secure realization of ${\mathrm{F}}^2\mathrm{GNN}$ preserves the utility and fairness behavior of the original plaintext training procedure. Figure 2 and Figure 3 compare the training curves of plaintext ${\mathrm{F}}^2\mathrm{GNN}$ and our secure implementation, denoted as ASS, on Pokec-n and Pokec-z, respectively.

Figure 2. Performance and fairness comparison on Pokec-n between ASS and ${\mathrm{F}}^2\mathrm{GNN}$.

Figure 3. Performance and fairness comparison on Pokec-z between ASS and ${\mathrm{F}}^2\mathrm{GNN}$.

As shown in Figure 2, the ASS implementation closely follows the plaintext F²GNN baseline on Pokec-n throughout the entire training process. For validation accuracy, both methods start from a similar level and gradually improve as training proceeds, with only minor fluctuations between the two curves. The validation AUC curves almost overlap across global rounds, indicating that secure computation does not affect the ranking performance of the learned model. Similar observations can be made for the fairness metrics. The statistical parity and equal opportunity curves of ASS follow the same trend as ${\mathrm{F}}^2\mathrm{GNN}$, suggesting that the secure implementation preserves the fairness-aware optimization and aggregation behavior of the plaintext baseline.

Figure 3 shows consistent results on Pokec-z. The validation accuracy and AUC curves of ASS remain very close to those of ${\mathrm{F}}^2\mathrm{GNN}$, and both methods converge to comparable final performance. Although small deviations appear during intermediate rounds, especially when the training curves fluctuate, these differences are minor and do not change the overall convergence trend. For fairness, ASS exhibits similar statistical parity and equal opportunity trends to ${\mathrm{F}}^2\mathrm{GNN}$. This demonstrates that securely computing the data-bias weights, model-fairness weights, and combined aggregation weights does not materially change the fairness behavior of the original framework.

In terms of efficiency, each global round introduces 2.66 s of online computation and 3.55 MB of online communication. Across 500 global rounds, this corresponds to 22.17 min of online computation and 1775 MB of online communication. These results show that Sec${\mathrm{F}}^2\mathrm{GNN}$ can provide privacy protection through secure computation with practical overhead while preserving the predictive and fairness performance of ${\mathrm{F}}^2\mathrm{GNN}$.

6.3. Performance Evaluation on Differential Privacy

Privacy accounting settings. To separate clipping bias from the effect of Gaussian noise, we fix the clipping threshold at $C=10$ and vary only the noise multiplier $\sigma$. We evaluate per-round privacy targets ${ϵ}_r\in \{1,{10}^3,{10}^6\}$, corresponding to $\sigma \in \{1.341,0.03166,0.001\}$, respectively. The standard deviation of the noise added to each aggregated update is $2\sigma C$. Results are reported over 500 rounds using the mean and sample standard deviation across five random seeds.

Evaluations. Table 2 and Figure 4 and Figure 5 demonstrate the expected privacy–utility–fairness trade-off. The strongest tested privacy setting, ${ϵ}_r=1$, substantially reduces validation accuracy and AUC. Increasing ${ϵ}_r$ reduces the noise, but ${ϵ}_r={10}^3$ still provides only limited utility. The ${ϵ}_r={10}^6$ setting approaches the non-private result, although its composed privacy cost is approximately $5\times {10}^8$ after 500 rounds and provides negligible practical privacy. For the fairness metrics, ${ϵ}_r=1$ and ${ϵ}_r={10}^3$ produce smaller statistical parity and equal opportunity gaps than the non-private baseline. However, these configurations also exhibit reduced utility, particularly under stronger privacy settings. Therefore, the reduced disparity should not be interpreted as evidence that differential privacy inherently improves fairness.

Table 2. Fixed-clipping privacy-budget comparison on Pokec-n and Pokec-z with $n=30$ and $C=10$. Values are final MA-20 validation metrics (mean ± sample standard deviation over five seeds). Lower ${\Delta }_{\mathrm{SP}}$ and ${\Delta }_{\mathrm{EO}}$ indicate smaller group-fairness gaps.

Dataset	Setting	$\mathit{\sigma }$	Estimated ${\mathit{ϵ}}_{\mathbf{500}}$	Accuracy $(\%)\uparrow$	AUC $(\%)\uparrow$	${\mathsf{\Delta }}_{\mathbf{SP}}(\%)\downarrow$	${\mathsf{\Delta }}_{\mathbf{EO}}(\%)\downarrow$
Pokec-n	Non-DP	–	–	$0.6299\pm 0.0326$	$0.6804\pm 0.0126$	$0.0341\pm 0.0162$	$0.0477\pm 0.0214$
	DP, ${ϵ}_r=1$	$1.341$	$9.43$	$0.4996\pm 0.0503$	$0.5361\pm 0.0502$	$0.0173\pm 0.0208$	$0.0125\pm 0.0075$
	DP, ${ϵ}_r={10}^3$	$0.03166$	$4.97\times {10}^5$	$0.5239\pm 0.0587$	$0.5292\pm 0.0479$	$0.0360\pm 0.0402$	$0.0351\pm 0.0316$
	DP, ${ϵ}_r={10}^6$	$0.001$	$5\times {10}^8$	$0.6263\pm 0.0285$	$0.6794\pm 0.0097$	$0.0310\pm 0.0177$	$0.0435\pm 0.0192$
Pokec-z	Non-DP	–	–	$0.6420\pm 0.0128$	$0.7104\pm 0.0149$	$0.0682\pm 0.0284$	$0.0530\pm 0.0213$
	DP, ${ϵ}_r=1$	$1.341$	$9.43$	$0.5046\pm 0.0108$	$0.5376\pm 0.0338$	$0.0357\pm 0.0352$	$0.0314\pm 0.0301$
	DP, ${ϵ}_r={10}^3$	$0.03166$	$4.97\times {10}^5$	$0.5089\pm 0.0082$	$0.5355\pm 0.0338$	$0.0341\pm 0.0294$	$0.0315\pm 0.0311$
	DP, ${ϵ}_r={10}^6$	$0.001$	$5\times {10}^8$	$0.6379\pm 0.0113$	$0.7097\pm 0.0157$	$0.0598\pm 0.0264$	$0.0480\pm 0.0191$

Figure 4. Performance and fairness comparison on Pokec-n with $n=30$. Curves show 20-round moving averages, and shaded regions indicate one standard deviation across five runs.

Figure 5. Performance and fairness comparison on Pokec-z with $n=30$. Curves show 20-round moving averages, and shaded regions indicate one standard deviation across five runs.

More importantly, the results reveal a substantial limitation of the current DP configuration. Under the strongest tested privacy setting, ${ϵ}_r=1$, the composed privacy budget after 500 rounds is ${ϵ}_{500}=9.43$, while the AUC decreases to $0.5361$ on Pokec-n and $0.5376$ on Pokec-z, indicating a substantial loss in predictive utility, with performance approaching that of random guessing. Conversely, the ${ϵ}_r={10}^6$ setting recovers utility close to the non-DP baseline, but its composed privacy budget is approximately $5\times {10}^8$, which provides no real privacy protection. Therefore, under the evaluated training configuration, we do not identify an operating point that simultaneously provides meaningful differential privacy and predictive utility close to the non-private baseline.

Discussions. The Gaussian noise in SaFeGNN is injected after the weighted aggregation of client updates and therefore does not directly modify the fairness-aware weights within the current communication round. Nevertheless, the perturbed global model is used in subsequent rounds, and the fairness weights are computed based on information derived from the global and local models. Hence, DP noise can indirectly influence the fairness weights by changing the global model and its predictions. With a larger noise multiplier, this effect may become more pronounced, potentially weakening the ability of the weighting mechanism to distinguish client updates according to their fairness-related characteristics. A systematic study of the stability and sensitivity of the fairness weights under DP perturbation is beyond the scope of this work and constitutes an important direction for future research.

7. Theoretical Privacy Analysis

7.1. Proof of DP Privacy

Lemma 3 (Per-round sensitivity).

Let C denote the clipping bound for each client update. Under client-level neighboring inputs $\mathcal{D},{\mathcal{D}}^{\prime }$, the ${\ell }_2$-sensitivity of the fairness-weighted aggregation in DP-Sec$F^2\mathit{GNN}$ is bounded by $2C$.

Proof. 

Let the fairness-weighted aggregation in round t be $f_t\left(\mathcal{D}\right)={\sum }_{i\in {\mathcal{C}}_t}{\gamma }_i^t\left(\mathcal{D}\right){\tilde{\Delta }}_i^t\left(\mathcal{D}\right)$, where ${\mathcal{C}}_t$ denotes the set of selected clients. Since the final aggregation weights are obtained through a softmax function, they satisfy ${\gamma }_i^t\left(\mathcal{D}\right)\ge 0,{\sum }_{i\in {\mathcal{C}}_t}{\gamma }_i^t\left(\mathcal{D}\right)=1$. Moreover, each client update is clipped such that ${∥{\tilde{\Delta }}_i^t\left(\mathcal{D}\right)∥}_2$$\le C$. Therefore, ${∥f_t\left(\mathcal{D}\right)∥}_2$ = ${∥{\sum }_{i\in {\mathcal{C}}_t}{\gamma }_i^t\left(\mathcal{D}\right){\tilde{\Delta }}_i^t\left(\mathcal{D}\right)∥}_2$ $\le {\sum }_{i\in {\mathcal{C}}_t}{\gamma }_i^t\left(\mathcal{D}\right)$ ${∥{\tilde{\Delta }}_i^t\left(\mathcal{D}\right)∥}_2$ $\le C$. The same bound holds for any neighboring input ${\mathcal{D}}^{\prime }$, regardless of how the data-dependent aggregation weights change: ${∥f_t\left({\mathcal{D}}^{\prime }\right)∥}_2$$\le C.$ Hence, $\Delta f_t={\max }_{\mathcal{D},{\mathcal{D}}^{\prime }}$ ${∥f_t\left(\mathcal{D}\right)-f_t\left({\mathcal{D}}^{\prime }\right)∥}_2$ $\le {\max }_{\mathcal{D},{\mathcal{D}}^{\prime }}($ ${∥f_t\left(\mathcal{D}\right)∥}_2$ + ${∥f_t\left({\mathcal{D}}^{\prime }\right)∥}_2$ $)\le 2C$. Conditioned on the models released in previous rounds, $w^t$ is fixed. Therefore, the update $w^{t+1}=w^t-f_t\left(\mathcal{D}\right)$ has the same ${\ell }_2$-sensitivity, bounded by $2C$. Accordingly, the Gaussian mechanism is calibrated using the sensitivity bound $\Delta f_t\le 2C$. □

Lemma 4 (Per-round RDP of DP-SecF²GNN).

Let q clients be sampled from n clients in round t, and let the client sampling rate be $q/n$. After clipping each client update to ${\ell }_2$ norm at most C, DP-SecF²GNN releases a noisy aggregate with Gaussian noise multiplier σ. Then, for any Rényi order $\alpha >1$, the per-round release satisfies $(\alpha ,{ϵ}_t\left(\alpha \right))$-RDP, where ${ϵ}_t\left(\alpha \right)$ is obtained from the subsampled Gaussian mechanism [44].

Theorem 1.

Assume that in each training round $t\in \left[T\right]$, conditioned on all previous released models $({\tilde{\mathbf{w}}}^1,\dots ,{\tilde{\mathbf{w}}}^{t-1})$, the release mechanism of DP-SecF²GNN satisfies $(\alpha ,{\epsilon }_t\left(\alpha \right))$-RDP with respect to client-level neighboring datasets, for any Rényi order $\alpha >1$. Then, after T adaptive training rounds, the released model sequence $({\tilde{\mathbf{w}}}^1,\dots ,{\tilde{\mathbf{w}}}^T)$ satisfies $\left(\alpha ,{\sum }_{t=1}^T{\epsilon }_t\left(\alpha \right)\right)\text{-}\mathit{RDP}$. Consequently, for any $\delta \in (0,1)$, DP-SecF²GNN satisfies $(ϵ,\delta )$-DP with $ϵ={\min }_{\alpha >1}\left\{{\sum }_{t=1}^T{\epsilon }_t\left(\alpha \right)+{\displaystyle \frac{\log (1/\delta )}{\alpha -1}}\right\}$.

Proof. 

Fix any Rényi order $\alpha >1$. By assumption, in each round t, the conditional release mechanism satisfies $(\alpha ,{\epsilon }_t\left(\alpha \right))$-RDP given the previous releases. Since RDP composes additively under adaptive composition, the joint release $({\tilde{\mathbf{w}}}^1,\dots ,{\tilde{\mathbf{w}}}^T)$ satisfies $\left(\alpha ,{\sum }_{t=1}^T{\epsilon }_t\left(\alpha \right)\right)\text{-}\mathrm{RDP}$. Applying the standard conversion from RDP to approximate differential privacy, an $(\alpha ,{\epsilon }_{\mathrm{RDP}}\left(\alpha \right))$-RDP mechanism satisfies $\left({\epsilon }_{\mathrm{RDP}}\left(\alpha \right)+{\displaystyle \frac{\log (1/\delta )}{\alpha -1}},\delta \right)\text{-}\mathrm{DP}$ for any $\delta \in (0,1)$. Substituting ${\epsilon }_{\mathrm{RDP}}\left(\alpha \right)={\sum }_{t=1}^T{\epsilon }_t\left(\alpha \right)$ and optimizing over $\alpha >1$ gives the claimed result. □

7.2. Security Analysis

We analyze the security of ${\Pi }_{{\mathrm{SecF}}^2\mathrm{GNN}}$ under the semi-honest, non-colluding two-server threat model defined in Section 4.2. In this setting, each server honestly follows the protocol specification but may try to infer private information from its local view. We assume that at most one of the two aggregation servers is corrupted, and that corrupted clients do not collude with any aggregation server. This assumption is consistent with standard two-server secure computation settings.

Definition 3 (Ideal functionality).

In each training round t, let $S_t$ denote the set of selected clients. Each client $C_i\in S_t$ holds a local model update ${\Delta }_i^t$, a group balance score $B_i$, and a fairness penalty ${\ell }_{\mathrm{fair},i}^t$. The ideal functionality ${\mathcal{F}}_{{\mathrm{SecF}}^2\mathrm{GNN}}$ receives ${\left\{{\Delta }_i^t,B_i,{\ell }_{\mathrm{fair},i}^t\right\}}_{i\in S_t}$ and computes the same fairness-aware aggregation function as plaintext F²GNN. Specifically, it computes the data-bias weights, model-fairness weights, combined aggregation weights, and the resulting aggregated model update. The functionality outputs only the final aggregated model update, or its differentially private variant in DP-SecF²GNN, and reveals no individual client update, group balance score, fairness penalty, or intermediate aggregation weight.

Theorem 2

(Security of SecF²GNN). Assume that the underlying two-party computation protocols securely realize addition, multiplication, comparison, exponential, and softmax over additive secret shares in the semi-honest, non-colluding two-server model. Then, ${\Pi }_{{\mathrm{SecF}}^2\mathrm{GNN}}$ securely realizes ${\mathcal{F}}_{{\mathrm{SecF}}^2\mathrm{GNN}}$ against any semi-honest adversary corrupting at most one aggregation server. In particular, the adversary learns nothing beyond its prescribed output and the public leakage.

Proof. 

We prove the theorem by considering the view of an arbitrary corrupted server $S_b$, where $b\in \{0,1\}$. The view of $S_b$ consists of its input shares, local randomness, intermediate shares generated during the protocol, and messages received from the other server.

First, each client secret-shares its private values, including ${\Delta }_i^t$, $B_i$, and ${\ell }_{\mathrm{fair},i}^t$, before sending them to the two servers. Under additive secret sharing, each individual share is uniformly distributed over the underlying ring and is information-theoretically independent of the plaintext value. Therefore, the initial shares received by $S_b$ reveal no information about any client’s local update, group balance score, or fairness penalty.

Second, all server-side computations are performed over secret-shared values. Linear operations, such as addition and multiplication by public constants, are performed locally on shares and do not reveal any plaintext information. Non-linear operations, including multiplication, comparison, exponential, and softmax, are invoked through secure two-party computation sub-protocols in [43]. By the security of these sub-protocols, the messages exchanged during their execution can be simulated from the corrupted server’s input shares and output shares alone. Hence, the adversary obtains no additional information from the server-to-server communication.

Third, the intermediate values produced during the aggregation procedure remain secret-shared. This includes the data-bias weights, model-fairness weights, combined aggregation weights, and the weighted aggregate of client updates. Since the corrupted server observes only one share of each intermediate value, these values remain hidden under the secrecy of additive sharing. The above concludes the proof. □

8. Limitations and Future Work

Although SaFeGNN provides a practical framework for combining fairness-aware federated GNN training with differential privacy and secure aggregation, several limitations remain and motivate future investigation.

Systematic evaluation of fairness-weight stability. Differential privacy inevitably introduces a trade-off among privacy, utility, and fairness. In SaFeGNN, Gaussian noise is added after the fairness-weighted aggregation of client updates and therefore does not directly perturb the aggregation weights used within the same communication round. However, the perturbed global model is redistributed to clients and used in subsequent rounds. Consequently, DP noise can indirectly affect local predictions and fairness penalties, which may in turn alter the model-fairness weights and the final combined aggregation weights in subsequent rounds. This effect may accumulate over training, and sufficiently large noise may reduce both utility and the effectiveness of the fairness-aware aggregation mechanism. Future work will systematically and quantitatively measure the stability of the model-fairness and combined aggregation weights under different DP noise levels and privacy budgets, and investigate how such instability affects utility and fairness.

Clipping and privacy accounting. The sensitivity analysis of the aggregation mechanism relies on bounding each client update by a clipping threshold. The formal privacy guarantee therefore depends on how this threshold is selected. In particular, adaptively determining a clipping threshold from private client updates can itself introduce data dependence and requires additional privacy analysis if it is used as part of the DP mechanism. Future work could investigate differentially private adaptive clipping mechanisms that automatically adjust the clipping threshold while accounting for the additional privacy cost, thereby potentially improving utility without weakening the end-to-end privacy guarantee.

Security assumptions of secure aggregation. The secure aggregation component protects individual client updates during aggregation under the security assumptions of the underlying MPC protocol. Our current implementation considers semi-honest computation parties and does not address malicious behavior, collusion beyond the assumed threat model, or Byzantine clients that intentionally manipulate their updates or fairness-related information. Furthermore, MPC protects intermediate updates during computation but does not by itself prevent information that may be inferred from the released global model; this is instead addressed by the differential privacy mechanism. Extending the framework to malicious-secure and dropout-robust aggregation, together with defenses against poisoning and manipulation of fairness-aware weights, would strengthen its applicability in adversarial federated environments.

9. Conclusions

In this paper, we presented SaFeGNN, a privacy-preserving framework for fair federated graph neural network training. SaFeGNN extends the fairness-aware federated GNN framework ${\mathrm{F}}^2\mathrm{GNN}$ by protecting group balance scores, fairness penalties, and aggregation weights. To achieve this, SaFeGNN securely realizes the non-linear fairness-aware aggregation process using two-party additive secret sharing, enabling the aggregation servers to compute the global update without observing individual client information.

We further integrated client-level differential privacy into SaFeGNN to protect information that can be leaked from the released global models across training rounds. By clipping client updates and adding calibrated Gaussian noise to the securely aggregated model, SaFeGNN provides privacy protection while preserving the fairness-aware training behavior of ${\mathrm{F}}^2\mathrm{GNN}$. Theoretical analysis shows that the privacy loss can be bounded through Rényi differential privacy and composed over multiple global training rounds.

Experimental results on Pokec-n and Pokec-z demonstrate that the secure computation layer closely preserves the utility and fairness performance of the plaintext ${\mathrm{F}}^2\mathrm{GNN}$ baseline, while introducing practical computation and communication overhead. Our DP evaluation demonstrates that client-level privacy can be formally incorporated into SaFeGNN, but also reveals a substantial privacy–utility trade-off. Under the evaluated configuration, stronger privacy budgets considerably degrade predictive utility, while utility is obtained only at privacy budgets that offer negligible practical protection. Improving this trade-off constitutes an important direction for future work.